Redact credentials from generate_content_config.http_options in debug logs - #6546
Open
prasanna8585 wants to merge 1 commit into
Open
Redact credentials from generate_content_config.http_options in debug logs#6546prasanna8585 wants to merge 1 commit into
prasanna8585 wants to merge 1 commit into
Conversation
… logs _build_request_log() in google_llm.py serializes req.config via model_dump() for DEBUG-level logging (logger.debug(_build_request_log(...)) in generate_content_async()), excluding only system_instruction and tools. It did not exclude http_options, so headers (commonly an Authorization bearer token), extra_body, client_args, and async_client_args -- all documented, legitimate places for a caller to put auth material for a custom model endpoint -- were written verbatim to the application's debug log stream. This is a live, unfixed sibling of the credential-tracing bug fixed in telemetry/tracing.py (761f1ac, "fix: stop tracing credentials passed via config.http_options"): same underlying data, same root cause, different sink (debug logs instead of trace spans), missed by that fix since it only touched _build_llm_request_for_trace, not this function. Also hardens the exception fallback: previously fell back to repr(req.config) on any model_dump() failure, which would have reintroduced the same leak unconditionally. Now falls back to a fixed, non-leaking placeholder string instead. lite_llm.py's own _build_request_log() was checked and is not affected -- it never dumps the whole config object, only specific safe fields (system_instruction, contents, function declarations).
adk-bot
added
the
tracing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
_build_request_log()ingoogle_llm.pyserializesreq.configviamodel_dump()for thelogger.debug(_build_request_log(llm_request))call ingenerate_content_async(), excluding onlysystem_instructionandtools. It did not excludehttp_options, soheaders(commonly anAuthorizationbearer token),extra_body,client_args, andasync_client_args-- all documented, legitimate places for a caller to put auth material for a custom model endpoint -- were written verbatim into the application's debug log stream whenever DEBUG logging is enabled.This is a live, unfixed sibling of the credential-tracing bug fixed in
telemetry/tracing.py(761f1ac, "fix: stop tracing credentials passed via config.http_options"): identical root cause and identical sensitive fields, just a different sink (debug logs vs. trace spans) that the original fix didn't cover since it only touched_build_llm_request_for_trace, not this function.Also hardens the exception fallback: it previously fell back to
repr(req.config)on anymodel_dump()failure, which would unconditionally reintroduce the same leak. Now falls back to a fixed, non-leaking placeholder string.lite_llm.py's own_build_request_log()was checked and is not affected -- it never dumps the whole config object, only specific safe fields (system_instruction,contents, function declarations).Verified against the real, patched package: the secret is absent from the log output while non-sensitive fields (e.g.
base_url) are still logged.